08ccc4452d1dee6da9362d6e0a91a0ee02842a1bddb679d2cb3c267cb8a4860f | Triage

Analysis

max time kernel
90s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 09:07

Sharing

Report Analysis Logs

General

Target

928免杀远控/Exmlrpc.dll
Size

92KB
MD5

2c9211cd380016db2f943ac96e6c8915
SHA1

95c75052feab202eaa402ca520bf968c9438f6c3
SHA256

3fbbb93599c220dbf6b37138f01eb64de6412e462be520eae1cf173b7d211338
SHA512

4aa15dbfe86a6f26a6e74959258322528e32eb32ff010f2fdaa75c5b138be40c34456ab9527ede8fe3b8adfacf7a2d8c1a690cb1095ab935ad1a61ff3be41992
SSDEEP

1536:aXdod+ZuPAQYWiTuPUavgf3UwsoMWX6Sn6St3wE:aXdoauPAEB3vgf3UwsoMWX6Sn6St3w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1828 wrote to memory of 1344	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 1344	1828	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 1344	1828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\Exmlrpc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\928免杀远控\Exmlrpc.dll,#1
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-132-0x0000000000000000-mapping.dmp

Download